Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Производитель ПО
Наименование ПО
Microsoft Excel
(2000, 2000 SP3, 2002, 2002 SP3, 2003, 2003 SP2, 2004 for Mac, v. X for Mac)
Microsoft Excel Viewer
(2003 )
Microsoft Office
(WorkSuite 2004, WorkSuite 2005, WorkSuite 2006)
Microsoft Updates
(KB2264397, KB2264403, KB2344893, KB2345017, KB2466169, KB2502786, KB2541003, KB2541025, KB2553072, KB2596954, KB2597086, KB2687481, KB2810048, KB923088, KB923089, KB923090, KB923275, KB923618, KB924998, KB924999, KB925257, KB925523, KB925524, KB925525, KB933666, KB934445, KB934447, KB934453, KB934737, KB936507, KB936508, KB936511, KB936513, KB940596, KB940601, KB940602, KB940604, KB943889, KB943985, KB946976, KB946979, KB951548, KB951551, KB951582, KB951589, KB955461, KB955464, KB955466, KB955468, KB958372, KB958434, KB958435, KB958436, KB959964, KB959988, KB959993, KB959995, KB969680, KB969681, KB969683, KB969685, KB973471, KB973475, KB973484, KB978471, KB978474, KB982133, KB982299)
Описание
В Excel имеется уязвимость удаленного запуска кода. Злоумышленник может воспользоваться данной уязвимостью при анализе файла и обработке искаженной записи DATETIME приложением Excel.
Как исправить
Используйте рекомендации производителя:
http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
Ссылки
MS (MS06-059): http://www.microsoft.com/technet/security/Bulletin/MS06-059.mspx
BUGTRAQ (20061010 ZDI-06-033: Microsoft Office Excel File Format DATETIME Record Parsing Vulnerability): http://www.securityfocus.com/archive/1/archive/1/448147/100/0/threaded
http://www.zerodayinitiative.com/advisories/ZDI-06-033.html
CERT-VN (VU#706668): http://www.kb.cert.org/vuls/id/706668
FRSIRT (ADV-2006-3978): http://www.frsirt.com/english/advisories/2006/3978
SECTRACK (1017031): http://securitytracker.com/id?1017031
HP (HPSBST02161): http://www.securityfocus.com/archive/1/archive/1/449179/100/0/threaded
OVAL (oval:org.mitre.oval:def:570): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:570
BID (20344): http://www.securityfocus.com/bid/20344
BUGTRAQ (20061010 ZDI-06-033: Microsoft Office Excel File Format DATETIME Record Parsing Vulnerability): http://www.securityfocus.com/archive/1/archive/1/448147/100/0/threaded
http://www.zerodayinitiative.com/advisories/ZDI-06-033.html
CERT-VN (VU#706668): http://www.kb.cert.org/vuls/id/706668
FRSIRT (ADV-2006-3978): http://www.frsirt.com/english/advisories/2006/3978
SECTRACK (1017031): http://securitytracker.com/id?1017031
HP (HPSBST02161): http://www.securityfocus.com/archive/1/archive/1/449179/100/0/threaded
OVAL (oval:org.mitre.oval:def:570): http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:570
BID (20344): http://www.securityfocus.com/bid/20344
